CVE-2026-119977high

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Risk score

8.1

CVSS 3.1

Vendor: WordPress Foundation
Product: WordPress
CWE: CWE-367
Published: Oct 31, 2026
Updated: Oct 31, 2026
CISA KEV: Not flagged

Affected products and versions

WordPress

WordPress Foundation

Version / range	Status	Type
4.7.0 to 4.7.38	affected	semver
4.8.0 to 4.8.33	affected	semver
4.9.0 to 4.9.34	affected	semver
5.0.0 to 5.0.30	affected	semver
5.1.0 to 5.1.27	affected	semver
5.2.0 to 5.2.29	affected	semver
5.3.0 to 5.3.26	affected	semver
5.4.0 to 5.4.24	affected	semver
5.5.0 to 5.5.23	affected	semver
5.6.0 to 5.6.22	affected	semver
5.7.0 to 5.7.20	affected	semver
5.8.0 to 5.8.18	affected	semver
5.9.0 to 5.9.19	affected	semver
6.0.0 to 6.0.17	affected	semver
6.1.0 to 6.1.15	affected	semver
6.2.0 to 6.2.14	affected	semver
6.3.0 to 6.3.13	affected	semver
6.4.0 to 6.4.13	affected	semver
6.5.0 to 6.5.13	affected	semver
6.6.0 to 6.6.10	affected	semver
6.7.0 to 6.7.10	affected	semver
6.8.0 to 6.8.11	affected	semver
6.9.0 to 6.9.10	affected	semver
7.0.0 to 7.0.7	affected	semver
7.1.0 to 7.1.3	affected	semver

Technical metrics

8.1

CVSS 3.1

Severity: high
Source: Wordfence
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H